OpenAPI / Swagger documentation exists
Why it matters
Without an OpenAPI spec, every external consumer — a mobile app, a third-party integration, a future backend service — must reverse-engineer your API from network traffic or source code. This directly undermines ISO-25010:2011 compatibility.interoperability and raises integration time proportionally with API surface area. Internal teams suffer the same friction: undocumented APIs attract inconsistent usage patterns and make breaking-change detection impossible without grep-and-hope. A spec is also the prerequisite for automated client SDK generation, contract testing, and mock servers.
Severity rationale
Low because missing documentation doesn't break runtime behavior, but it compounds integration cost and makes every API change riskier for consumers who can't validate their assumptions.
Remediation
Generate an OpenAPI spec from your existing Zod validation schemas rather than writing it by hand. If you're already using Zod (recommended), zod-to-openapi converts schemas you already have:
// src/openapi.ts
import { OpenAPIRegistry, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi'
const registry = new OpenAPIRegistry()
registry.registerPath({
method: 'post',
path: '/api/v1/users',
request: { body: { content: { 'application/json': { schema: createUserSchema } } } },
responses: { 200: { description: 'User created' } },
})
Commit the generated openapi.yaml to the repo and serve it at /api/docs in development. For ts-rest, the spec generates automatically from your contract definitions — no extra work.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · compatibility.interoperability — Interoperability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from saas-api-design·automated